Mitchell R 436d2d730c feat(harden): hardware-bound at-rest encryption of kiosk state files ... New module kiosk/src/at_rest.rs. Derives an AES-256-GCM key via HKDF from a Pi-bound value: 1. /proc/device-tree/serial-number (Pi 5 firmware exposes it) 2. /proc/cpuinfo Serial line (older kernels) 3. /etc/machine-id (non-Pi dev fallback) File format: "BFE1" magic || 12-byte random nonce || ciphertext+tag. Atomic write via tempfile + rename so a crash mid-write can't leave a half-encrypted file. Wired into kiosk/src/server.rs at every file I/O touching sensitive state: - kiosk.key (bearer token to BF server) - local.key (LAN-side API auth key) - bundle.json (cached bundle with RTSP credentials in URL form) Migration: read paths tolerate legacy plaintext (kiosks upgraded from a pre-at_rest build) AND re-store as ciphertext on the first read. One- shot upgrade — subsequent boots skip the migration write. Threat model defended: SD card extraction. Attacker who pulls the card can't decrypt without also having the same physical Pi (CPU serial is hardware-bound). Doesn't defeat an attacker who has both — at that point they ARE the kiosk. Bar is raised from "trivially extract every camera password" to "must steal the device intact." Not defended: TPM-style attestation, remote attestation, sealed boot. Pi 5 has no TPM and we don't ship a secure-boot config. Tests in-module: round-trip short bytes, round-trip JSON, legacy plaintext passthrough.		2026-05-21 11:34:29 +02:00
..
src	feat(harden): hardware-bound at-rest encryption of kiosk state files	2026-05-21 11:34:29 +02:00
Cargo.lock	feat(ota): add RAUC OS update foundation	2026-05-20 05:15:29 +02:00
Cargo.toml	feat(harden): hardware-bound at-rest encryption of kiosk state files	2026-05-21 11:34:29 +02:00
prototype.sh	fix(deploy): require proxied local services	2026-05-11 09:51:00 +02:00